Security tweaks: check_plain and urlencode to sanitize user-input search args